Proxmark 3
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Attacking RFID Systems with Proxmark3
The first thing you need to do is to have a Proxmark3 and install the software and it's dependencies.
Attacking MIFARE Classic 1KB
It has 16 sectors, each of them has 4 blocks and each block contains 16B. The UID is in sector 0 block 0 (and can't be altered). To access each sector you need 2 keys (A and B) which are stored in block 3 of each sector (sector trailer). The sector trailer also stores the access bits that give the read and write permissions on each block using the 2 keys. 2 keys are useful to give permissions to read if you know the first one and write if you know the second one (for example).
Several attacks can be performed
The Proxmark3 allows to perform other actions like eavesdropping a Tag to Reader communication to try to find sensitive data. In this card you could just sniff the communication with and calculate the used key because the cryptographic operations used are weak and knowing the plain and cipher text you can calculate it (mfkey64
tool).
Raw Commands
IoT systems sometimes use nonbranded or noncommercial tags. In this case, you can use Proxmark3 to send custom raw commands to the tags.
With this information you could try to search information about the card and about the way to communicate with it. Proxmark3 allows to send raw commands like: hf 14a raw -p -b 7 26
Scripts
The Proxmark3 software comes with a preloaded list of automation scripts that you can use to perform simple tasks. To retrieve the full list, use the script list
command. Next, use the script run
command, followed by the script’s name:
You can create a script to fuzz tag readers, so copying the data of a valid card just write a Lua script that randomize one or more random bytes and check if the reader crashes with any iteration.
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Last updated